Let's start at the CLI and take a look at what we're going to do.
So remember, we've got to configure something on the edge,
the advertisement of the service,
and then we're going to get onto the controller
and configure a control policy,
which will tell everybody else to use this service,
depending on what traffic we want to match on.
So we're going to start by just running a command here.
We can do the show.
Actually, it's show sdwan omp services.
This is a great command on the controller.
We don't need sdwan, but on the edge, we do.
So what we can do is we can see right away
whether we have any interesting services configured.
Now, this VPN service is really just saying that,
hey, we've got a VPN,
and remember that concept of the label that I mentioned,
which tells the receiving edge what to do.
So if we get this particular label in a packet,
that just means to route it into VPN 10.
And so we have one for VPN 20 as well.
So that's great, but we don't actually have
any other services configured,
and that's what we're here to do.
So I'm going to do a config-t,
get into the sdwan side of things,
and from here, I'm going to type service,
and then we're going to see
that we've got specific types of services,
including a firewall service, IDS or IPS.
We've got those network services
that we talked about earlier on in the course.
So I'm just going to configure a firewall service,
and from here, we're going to specify next the VRF.
So I can say VRF 10, which is VPN 10,
and then I need to specify the IP address.
So I'll specify IPv4 address,
and then something like 10.10.13.50.
That would be the Ubuntu host that is in VPN 10.
Whoops, right.
What is that?
I'm just trying to highlight the second.
There we go, we got it.
All right, so that second octet means that we're on VPN 10.
The third octet here means that we're at site 13,
and the .50 is the Ubuntu host.
But either way, we're not going to fully get this working,
because we don't actually have a firewall service here,
just an Ubuntu host.
So either way, what we do here now is we simply commit this,
and we can end out of our configuration,
and now I can do that same command,
the show sdwan omp services,
and now we'll notice that the entry is a little bit longer.
Right in the middle here, we have this firewall service.
So we've got the firewall service with a new label.
We're using 1003 to say,
hey, we're just sending to VPN,
whoops, right here, VPN 10,
and we're using 1006 when we want to send a VPN 20.
Well, now we're using 1008
when we want to send to the firewall.
So that's a great start.
That tells us that our edge
is now advertising this firewall service
via the OMP service routes,
but now we need to configure our controller.
So let's flip over to the controller,
and of course, we've been timed out.
So let's log back in here,
and now we're going to configure that policy.
So I'm going to do a config T,
get into the policy section of our controller.
Again, we've just gotten done doing a lot of these types of policies.
So what we're going to do is create a control policy.
I'll call it something like FW service,
and remember, the first thing we have to do
is define a sequence number.
So I'll define sequence number 10,
and now we have the match action statements,
but not just match action.
I have to match based on either the route or the TLOC.
So this is interesting because it basically feels
like we're configuring that control policy,
which defines for us a topology,
and on the one hand, it's not really defining a topology,
but on the other hand, it kind of is, isn't it?
Because it's telling us where we want to send our traffic.
Now, regardless of whether it really is
or is not doing topologies,
just keep in mind the topology concept
is more of a templatized version of things, right?
What we're really doing is controlling our routes,
and we're controlling our TLOCs,
and with the routes, we can do things like changing next hops,
for example, and do some fun things like that
that we've demonstrated earlier on,
and so it doesn't matter whether we think
we're doing topologies or not.
What we're really doing is configuring a control policy,
and we're going to take advantage of the route type of policy,
so I'm going to do match route,
and I can do whatever I want here.
We've got all kinds of options.
We can just do a site list, like, you know, site list,
and then I'm trying to remember the names of our site list.
I guess we just have site 11 configured here,
so I can say site list, site 11, and then exit out of this,
and I'm still in sequence 10.
I did my match statement,
and now I need to do my action statement,
which is to accept, but then we can use the set command,
so I can change things.
I can say set service,
and then we'll find that we've got a whole list of services up here,
and notice I'm going to use FW.
Now, this is all caps FW,
so I'm going to have to specify this for the baked-in version of this.
Now, notice that on the controller, we have FW, IDS, and IDP.
This looked different on the edge,
because as we recall, when we did the question markup here,
we saw firewall spelled out.
We saw intrusion detection preventional wrapped up into one,
and so it's not FW and IDS and IPS.
It's a little bit different on the Viptela side versus the iOS XE side,
so either way, I'm going to hit enter,
and then at this point, I would do my commit.
Oh, and we can't do that, because we're being managed by vManage,
so our SD-WAN manager.
So I can't actually do the commit on the controller,
but this is how we would do it at the CLI
if we were trying to manage our SD-WAN environment via CLI.
So let's go and take a look at the graphical user interface now
and see how to do it over on that side.
Now, as always, when we're doing graphical user interface configuration,
it's going to feel like we're doing everything we just did at the CLI,
just slightly different here at the UI,
but the steps are the same.
So if I want to configure an edge like we talked about at the chalkboard,
if I want to configure edges, I'm going to do that via templates.
So I'm going to come in here,
and I'm going to take a look at my feature templates,
and at first glance, it might be anyone's guess
as to which of these feature templates I need to edit
or do I need to add a new one,
but our service is going to be defined inside of the VPN template.
So I'm going to choose, for example, like VPN 20 here as a VPN template,
or I could scroll up and do VPN 10.
So let's just go and do VPN 10.
I'll edit the VPN 10 template,
and as we mentioned, we have to define which VPN this participates in.
At the CLI, I said what VRF it was part of.
Well, I don't have to specify the VPN anymore
because it's part of this very VPN policy.
I'm defining myself here, or for myself, I'm defining VPN 10.
So where we go now is we click service,
and right here, the service section, we click new service,
and this should look pretty familiar.
I'm going to specify the type.
Now, again, we're on Viptela, so a version,
so we see FW as a type.
I can do my IP address, 10.10. let's say 13.50 again,
and then we can add tracking or not,
which was an option at the CLI as well.
So that is how we would do that.
We'd update this and push it out to the edge.
So that would be our configuration for the edge to advertise the service.
From here, I'm going to say configuration and go to policies
to take a look at how we do this.
So I'm just going to add a new centralized control policy.
I'm going to skip past our groups of interest,
and what's interesting about this, again,
is I'm going to use this add topology dropdown.
I'm not, strictly speaking, creating a topology,
but what I do need is a custom control policy
that gives me full control over the routes and TLOCs.
So I'm going to add a route policy here, add a sequence rule,
and now this is what gets me to my match action statement.
So if I want to do what I did at the CLI,
I am going to match on, let's say, something like my site.
I can select my site list here,
and then under actions, I can change this over to accept,
and when I do, I get all of these options for things I can set.
We demonstrated earlier that I could set a preference.
I can set an OMP tag. I can also set a service.
So here I click service,
and then my service type is going to be firewall.
I can add some other parameters in here,
and that is how we go about configuring a service insertion
at the graphical user interface.